Deals

Set or upload the deal sponsor image

POST/deals/{dealId}/sponsor-image
deals:writeset_deal_sponsor_image

Sets the deal's sponsor image and returns the deal, as GET /deals/{id} does. Send either attachment_id (a file already in the deal's assets folder, as JSON) or file (an image of up to 10 MB, as multipart form data), never both. An uploaded file is stored in the deal's assets folder. A deal with no assets folder returns 409, and an attachment_id that is not in that folder returns 422 exists. A published deal accepts it. It does not take dry_run: sending it returns 422. Emits deal.updated with sponsor_image_id in changed_fields and sends no email. DELETE /deals/{dealId}/sponsor-image undoes it, though an uploaded file stays in the folder. PATCH /deals/{id} with sponsor_image_id sets an existing file.

Path parameters

  • dealIdstring (uuid)Required#

    The deal's public uuid.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required

  • attachment_idstring (uuid)Required#

    A file in the deal's assets folder.

{
  "attachment_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f"
}

Responses

200

OK

Deal
{
  "data": {
    "id": "f6071829-3a4b-4c5d-9e6f-8091a2b3c4d5",
    "name": "Series B — Acme Robotics",
    "status": "published",
    "external": false,
    "external_id": "CRM-2026-0042",
    "summary": "Late-stage growth round in autonomous logistics.",
    "description": "<p>Acme Robotics is raising a Series B.</p>",
    "currency": "USD",
    "min_investment": 25000,
    "structure": "direct",
    "sub_structure": "equity",
    "type_details": {
      "sector": "information_technology",
      "growthStage": "growth"
    },
    "sponsor": "Acme Capital",
    "show_funding_secured": true,
    "allow_questions": false,
    "request_further_docs": false,
    "available_from": "2026-07-01T00:00:00+00:00",
    "available_to": "2026-09-30T23:59:59+00:00",
    "transaction_workflow_id": "1b2c3d4e-5f60-4a7b-8c9d-0e1f2a3b4c5d",
    "investor_engagement_enabled": true,
    "active_tranche_id": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "drafted_at": "2026-06-15T10:30:00+00:00",
    "approval_started_at": "2026-06-16T09:00:00+00:00",
    "approved_at": "2026-06-17T09:00:00+00:00",
    "published_at": "2026-06-18T09:00:00+00:00",
    "rejected_at": null,
    "retired_at": null,
    "tabs": [
      "deal",
      "documents",
      "video"
    ],
    "image_id": "3c4d5e6f-7a8b-4c9d-8e0f-1a2b3c4d5e6f",
    "sponsor_image_id": null,
    "video_id": "76979871",
    "custom_status_id": null,
    "created_at": "2026-06-15T10:30:00+00:00",
    "updated_at": "2026-06-18T09:00:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/deals/{dealId}/sponsor-image\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "attachment_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f"
}'